When I'm introducing SE to family and friends and they ask me if it's safe to login to StackExchange using their Gmail id, I don't have an answer to give them.
How is it safe? How can I convince anyone that their Gmail password won't be compromised?
How does the login work behind the scenes?

p.s: I first logged into SO by creating an OpenID because I couldn't convince myself that a Gmail login would be safe.

  • 1
    It must be at least somewhat safe. I use it and no on is trying to-- – John Nov 21 '11 at 6:02

The Google login is just another OpenID option, and is as secure as any other. It sends you to Google, who confirms your identity, and sends you back to Stack Overflow. Stack Overflow only sees your email address.

| improve this answer | |

I strongly suggest turning on Google's two-factor authentication. Even if your password is somehow compromised, the attacker still needs access to your phone or your list of one-time use backup codes.

Stack Exchange is trustworthy, and the Google login relies on the transparent OpenID protocol, but the two-factor authentication means that you don't have to take my or anyone else's word about it. As long as you're judicial with where you store your backup codes, there's no way to be compromised without someone having your password and physical access to your phone.

| improve this answer | |
  • That's excellent, first I've heard of it. Thanks! – sarnold Nov 21 '11 at 9:14
  • I keep loosing my backup codes. I hate it when my phone goes flat. Especially when I'm at the train station and need to access my mail to get my booking reference. – Matt Nov 21 '11 at 11:55
  • 2
    @Matt print out your backup codes and keep them in your wallet – Kyle Cronin Nov 21 '11 at 11:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .